@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/cli/serve-hardening.js

@@ -36,11 +36,16 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.IDENTITY_HEADER_ENV = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
+exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.REQUIRE_TENANT_ISOLATION_ENV = exports.IDENTITY_PROXY_SECRET_ENV = exports.IDENTITY_HEADER_ENV = exports.PIN_ONLY_IDENTITY_HEADERS = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.SERVICE_USER_ENV = exports.DEFAULT_MAX_BODY_BYTES = void 0;
 exports.resolveStateDir = resolveStateDir;
 exports.resolveAnalyticsSessionsDir = resolveAnalyticsSessionsDir;
+exports.resolveServiceIdentity = resolveServiceIdentity;
+exports.isLoopbackHost = isLoopbackHost;
 exports.resolveBindHost = resolveBindHost;
 exports.clientIp = clientIp;
+exports.hasTrustedProxyProof = hasTrustedProxyProof;
+exports.identityHeaderAdvice = identityHeaderAdvice;
+exports.tenantIsolationAdvice = tenantIsolationAdvice;
 exports.resolveUserId = resolveUserId;
 exports.resolveDataToken = resolveDataToken;
 exports.peerToUserId = peerToUserId;
@@ -59,12 +64,15 @@ exports.readBodyWithCap = readBodyWithCap;
  *
  * SECURITY CONTRACT: serve trusts the identity and data-token headers below unconditionally.
  * It MUST sit behind a proxy that (a) authenticates the caller and sets the identity header,
- * and (b) STRIPS any client-supplied copies of these headers on the way in.
+ * and (b) STRIPS any client-supplied copies of these headers on the way in. Deployments where
+ * other workloads share the network with serve (compose, sidecar platforms) can additionally
+ * require proof that a request came through that proxy — see IDENTITY_PROXY_SECRET_ENV.
  */
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const paths_1 = require("../utils/paths");
+const config_1 = require("../auth-broker/config");
 /** Default cap on a single request body (1 MiB). Chat messages are small; large bodies are abuse or bugs. */
 exports.DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
 /**
@@ -107,8 +115,63 @@ function resolveAnalyticsSessionsDir(stateDir, stateDirEphemeral, env = process.
     }
     return path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions');
 }
+/**
+ * Env: the identity an UNATTENDED turn runs as — a cron- or channel-fired run with no chat peer
+ * (PLAN/agent-identity.md §5). Deployment configuration, deliberately not a pack field: it names
+ * an identity that exists only in the operator's environment and must match their role map.
+ */
+exports.SERVICE_USER_ENV = 'AGENTHIPPO_SERVICE_USER';
+/** Longest identity we will carry. Generous; the point is to reject a pasted file, not to be tight. */
+const MAX_SERVICE_USER_LEN = 256;
+/**
+ * Validate the service identity at boot.
+ *
+ * **Shape, not vocabulary.** An earlier draft of the design required `^svc:[a-z0-9-]+$` and would
+ * have refused to boot on the two handles an enterprise operator is most likely to bind: a SPIFFE
+ * ID (`spiffe://corp/ns/agents/invoice`) and a Microsoft Entra agent identity object id. Both are
+ * exactly the federated principals §8 wants this to become, so the validator checks that the value
+ * is a usable single token and warns — rather than refuses — when it carries no recognisable
+ * namespace.
+ *
+ * Malformed IS a boot refusal though: the alternative is a fleet that looks configured and runs
+ * every scheduled job anonymously.
+ */
+function resolveServiceIdentity(env = process.env) {
+    const raw = env[exports.SERVICE_USER_ENV];
+    if (raw === undefined) {
+        return {};
+    }
+    const identity = raw.trim();
+    if (!identity) {
+        return { error: `${exports.SERVICE_USER_ENV} is set but empty. Unset it, or give it the identity unattended runs should act as.` };
+    }
+    if (/\s/.test(identity)) {
+        return { error: `${exports.SERVICE_USER_ENV} must not contain whitespace, got ${JSON.stringify(raw)}.` };
+    }
+    if (identity.length > MAX_SERVICE_USER_LEN) {
+        return { error: `${exports.SERVICE_USER_ENV} is ${identity.length} chars; the maximum is ${MAX_SERVICE_USER_LEN}.` };
+    }
+    // Recognised shapes: the local convention, a SPIFFE ID, or a bare GUID (Entra object id).
+    const namespaced = /^svc:/.test(identity)
+        || /^spiffe:\/\//.test(identity)
+        || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(identity);
+    if (!namespaced) {
+        return {
+            identity,
+            warning: `${exports.SERVICE_USER_ENV}="${identity}" carries no namespace marker (svc: / spiffe:// / GUID). `
+                + 'It will be used verbatim and must be mapped in the connector role map, exactly like a human identity. '
+                + 'If it can collide with a real user id, prefix it with `svc:`.',
+        };
+    }
+    return { identity };
+}
 /** Loopback default — safe everywhere a human runs `serve` locally. */
 exports.DEFAULT_BIND_HOST = '127.0.0.1';
+/** True when a bind address is reachable only from this machine. */
+function isLoopbackHost(host) {
+    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    return h === 'localhost' || h === '::1' || /^127\./.test(h);
+}
 /** Env var for the listen address (used by generated deploy Dockerfiles). */
 exports.SERVE_HOST_ENV = 'AGENTHIPPO_SERVE_HOST';
 /** Bind address baked into container deploy artifacts (Docker / Cloud Run sidecars). */
@@ -204,15 +267,177 @@ class RateLimiter {
     }
 }
 exports.RateLimiter = RateLimiter;
+/**
+ * Identity headers trusted when NOTHING is pinned.
+ *
+ * Every entry here is a header that exactly one platform sets AND owns the request path for, so
+ * a client-supplied copy cannot reach serve without that platform having been bypassed entirely.
+ *
+ * `x-agent-user` is deliberately NOT in this list, and this is a breaking change for anything
+ * that relied on it being trusted by default. It is AgentHippo's own canonical header — the name
+ * an arbitrary client is most likely to guess — it belongs to no platform that strips it, and it
+ * used to sit FIRST, so it beat every platform header that follows. The consequence on any
+ * deployment that had not pinned `AGENTHIPPO_IDENTITY_HEADER`: any HTTP client could send
+ * `x-agent-user: victim@example.com` and be namespaced into that user's session state, attach to
+ * their conversation, and be issued a data-plane turn nonce scoped to them. Cloud Run IAP makes
+ * this concrete — it strips `X-Goog-*` and forwards a client-supplied `x-agent-user` untouched.
+ *
+ * It remains perfectly valid as a PINNED header (`AGENTHIPPO_IDENTITY_HEADER=x-agent-user`),
+ * which is what a deployment whose proxy really does set and strip it should use — including the
+ * Caddy `forward_auth` flow, where `auth-broker/server.ts` sets `X-Agent-User` on `/api/ide/me`
+ * so Caddy can copy a VALIDATED identity upstream. That direction is the correct and only source
+ * of the header, and it is unaffected: pinning is exactly the declaration that it is trustworthy.
+ */
 const HEADER_ALIASES = [
-    'x-agent-user', // AgentHippo canonical (set by our Worker / generic proxy)
     'x-forwarded-email', // Databricks Apps
     'x-forwarded-preferred-username', // Databricks Apps
     'x-goog-authenticated-user-email', // Cloud Run IAP (prefixed value, stripped below)
     'cf-access-authenticated-user-email', // Cloudflare Access
 ];
+/**
+ * Headers that are only ever trusted when explicitly pinned.
+ *
+ * Kept as a named list rather than deleted, because "why is my identity header ignored?" needs an
+ * answer, and `identityHeaderAdvice` gives one that names the env var to set.
+ */
+exports.PIN_ONLY_IDENTITY_HEADERS = ['x-agent-user'];
 /** Env var: pin the single identity header the deploy layer actually sets (and strips). */
 exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
+/**
+ * Env var: shared secret proving the identity header was set by the trusted proxy, not by
+ * something else that can reach serve's port.
+ *
+ * Pinning declares WHICH header carries identity; it says nothing about WHO may assert it. On a
+ * shared network (compose, sidecar platforms where every container shares localhost) any
+ * neighbour that can dial serve can send the pinned header and be namespaced as that user —
+ * network topology cannot express "the agent may dial the gateway but not the reverse". When
+ * this is set, serve honours identity headers only on requests that also carry the matching
+ * `x-agenthippo-proxy-secret` (the same proof-of-proxy contract the auth-broker enforces for
+ * `X-Auth-Request-Email`); without proof the request runs anonymous, same as an unpinned
+ * header. Opt-in: unset keeps today's behaviour, because platform-header deployments (IAP,
+ * Databricks Apps) have an unforgeable header and no proxy hop that could attach a secret.
+ */
+exports.IDENTITY_PROXY_SECRET_ENV = 'AGENTHIPPO_IDENTITY_PROXY_SECRET';
+/**
+ * Proof that an identity header was set by the trusted proxy and not by a client: the request
+ * carries `x-agenthippo-proxy-secret` matching the configured secret. Shared with the
+ * auth-broker, which applies the same contract to `X-Auth-Request-Email` (it lives here rather
+ * than in the broker because the broker already imports from this module).
+ */
+function hasTrustedProxyProof(headers, expectedSecret) {
+    if (!expectedSecret) {
+        return false;
+    }
+    const raw = headers[config_1.AUTH_PROXY_SECRET_HEADER];
+    const presented = typeof raw === 'string' ? raw : Array.isArray(raw) ? String(raw[0] ?? '') : '';
+    if (!presented) {
+        return false;
+    }
+    // Hash both sides first: timingSafeEqual throws on a length mismatch, which would itself leak
+    // the secret's length.
+    const a = crypto.createHash('sha256').update(presented).digest();
+    const b = crypto.createHash('sha256').update(expectedSecret).digest();
+    return crypto.timingSafeEqual(a, b);
+}
+/**
+ * Boot-time advice about identity trust. Returns the lines serve must print, loudest first.
+ *
+ * Not a refusal. Refusing to boot without a pin would stop deployments that are configured
+ * correctly today (Databricks Apps, Cloudflare Access) and whose platform header is genuinely
+ * unforgeable — a fail-closed default that mostly punishes the compliant is not a security win.
+ * What was actually dangerous was `x-agent-user` being trusted by default, and that is now gone.
+ */
+function identityHeaderAdvice(env = process.env, bindHost) {
+    const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim();
+    if (pinned) {
+        return [];
+    }
+    // Severity follows reachability. On loopback nothing off-box can reach the port, so the same
+    // paragraph every local run is warning fatigue — and fatigue is why the message gets ignored
+    // on the deploy where it decides whether strangers can name themselves as another user.
+    const host = bindHost?.trim();
+    if (host && isLoopbackHost(host)) {
+        return [
+            `${exports.IDENTITY_HEADER_ENV} is not set. Fine for this loopback bind; pin it before exposing ` +
+                `serve on a network interface.`,
+        ];
+    }
+    return [
+        ...(host
+            ? [`serve is bound to ${host} — reachable beyond this machine — with no ${exports.IDENTITY_HEADER_ENV} pinned. ` +
+                    `Anyone who can reach this port is trusted to state who they are.`]
+            : []),
+        `${exports.IDENTITY_HEADER_ENV} is not set, so identity falls back to the platform header aliases ` +
+            `(${HEADER_ALIASES.join(', ')}). That is only safe when your proxy sets AND STRIPS every one of them. ` +
+            `Pin the single header your deploy layer really controls, e.g. ${exports.IDENTITY_HEADER_ENV}=x-goog-authenticated-user-email.`,
+        `NOTE: ${exports.PIN_ONLY_IDENTITY_HEADERS.join(', ')} is NO LONGER trusted by default — it is not stripped by any ` +
+            `platform, so an arbitrary client could send it and be namespaced as another user. If your proxy does set it ` +
+            `(the Caddy forward_auth / auth-broker flow does), pin it: ${exports.IDENTITY_HEADER_ENV}=x-agent-user.`,
+    ];
+}
+/** Env var: turn the tenant-isolation advice below into a boot refusal. */
+exports.REQUIRE_TENANT_ISOLATION_ENV = 'AGENTHIPPO_REQUIRE_TENANT_ISOLATION';
+/** True when `child` is `parent` or sits beneath it. */
+function isWithin(child, parent) {
+    const c = path.resolve(child);
+    const p = path.resolve(parent);
+    return c === p || c.startsWith(p + path.sep);
+}
+/**
+ * Boot-time advice about what a second user of this agent can read off the disk.
+ *
+ * The condition this exists for: a deployment that PINS an identity header has declared it serves
+ * more than one person, and a tier-0 (`--sandbox=process`) or sandbox-less serve gives every one
+ * of them the same uid, the same workspace and the same state dir. Per-user namespacing —
+ * `userScopedEngineHome`'s `users/<hash>`, user-namespaced session keys, per-session analytics
+ * JSONL — is naming, not access control: a same-uid process reads its neighbours' names by
+ * listing the directory. What sits there is the engines' own session files, i.e. the plaintext of
+ * every other user's conversation, including whatever rows the OBO connector correctly scoped to
+ * them on the way in. The data path stays isolated and the artifact path undoes it.
+ *
+ * The nesting check is the sharper half. `--workspace=/state/workspace --state-dir=/state` is the
+ * shape the samples shipped, and it puts the artifact store one `..` above the agent's own cwd —
+ * so reaching it takes no traversal trick, just a relative path. Unrelated subtrees
+ * (`--workspace=/work --state-dir=/state`) do not make a same-uid process unable to read /state;
+ * they stop it being the obvious next directory.
+ *
+ * Warn, not refuse, by default — the shipped samples are in exactly this shape and a fatal check
+ * would brick them on upgrade, which is the same trade `identityHeaderAdvice` documents. An
+ * operator who has finished the migration sets REQUIRE_TENANT_ISOLATION_ENV and gets the refusal.
+ */
+function tenantIsolationAdvice(input, env = process.env) {
+    // Unpinned means serve cannot tell one caller from another at all; identityHeaderAdvice owns
+    // that case and saying both at once buries the one the operator can act on.
+    if (!env[exports.IDENTITY_HEADER_ENV]?.trim()) {
+        return { level: 'ok', lines: [] };
+    }
+    const perSessionFilesystem = input.sandbox === 'container' && !input.sharedWorkspace;
+    if (perSessionFilesystem) {
+        return { level: 'ok', lines: [] };
+    }
+    const tier = input.sandbox === 'process' ? 'a tier-0 (--sandbox=process) sandbox' : 'no sandbox';
+    const lines = [
+        `${exports.IDENTITY_HEADER_ENV} is pinned — so this serve has more than one user — but it runs with ` +
+            `${tier}, which shares one uid, one workspace (${input.workspace ?? 'unset'}) and one state dir ` +
+            `(${input.stateDir}) across all of them. Any user can read every other user's engine session ` +
+            `files, which hold their conversations verbatim. Per-user paths are namespacing, not isolation.`,
+        `The boundary is --sandbox=container (per-session workspace and state, without ` +
+            `--shared-workspace) or one serve per tenant. Until then, restrict the pack's tool surface so ` +
+            `the agent has no way to read arbitrary files.`,
+    ];
+    if (input.workspace && isWithin(input.workspace, input.stateDir)) {
+        lines.push(`--workspace ${input.workspace} sits INSIDE --state-dir ${input.stateDir}: every other ` +
+            `user's sessions, analytics and evidence spool are one '..' above the agent's own cwd. ` +
+            `Put them in unrelated subtrees (e.g. --workspace=/work --state-dir=/state).`);
+    }
+    else if (input.workspace && isWithin(input.stateDir, input.workspace)) {
+        lines.push(`--state-dir ${input.stateDir} sits INSIDE --workspace ${input.workspace}: every other ` +
+            `user's sessions, analytics and evidence spool are inside the directory the agent is ` +
+            `pointed at. Put them in unrelated subtrees (e.g. --workspace=/work --state-dir=/state).`);
+    }
+    const strict = /^(1|true|yes|on)$/i.test(env[exports.REQUIRE_TENANT_ISOLATION_ENV]?.trim() ?? '');
+    return { level: strict ? 'refuse' : 'warn', lines };
+}
 /**
  * Resolve the end-user identity for a request.
  *
@@ -222,7 +447,10 @@ exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
  * that pins a header has declared it has a real proxy-verified identity, so an
  * unauthenticated caller must not be able to name themselves via the client-
  * controlled body. Body fallback is dev/internal convenience for the *unpinned*
- * case only (e.g. direct curl against a local serve with no identity proxy).
+ * case only (e.g. direct curl against a local serve with no identity proxy) —
+ * and it must be OPTED INTO via AGENTHIPPO_ALLOW_BODY_IDENTITY=1 (serve-v4 §10
+ * hole 3). Before the gate it was safe "by convention": any deployment that
+ * forgot to pin a header silently let every caller name an arbitrary victim.
  *
  * The alias-list default (used when unpinned) is only safe when the proxy strips
  * or overwrites ALL of the aliases; platforms that strip only their own header
@@ -231,14 +459,22 @@ exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
  * artifacts set it (e.g. cloudrun-deploy.sh pins `x-goog-authenticated-user-email`)
  * so an authenticated caller cannot impersonate another user.
  *
- * Resolves identity for `analyticsUserId` attribution and the request-scoped
- * credential context (per-user data scoping). Not folded into the session key —
- * session continuity uses the client-supplied `session_id`.
+ * Resolves identity for `analyticsUserId` attribution, the request-scoped
+ * credential context (per-user data scoping), and the user-namespaced session
+ * key (resolveServeSessionKey folds this identity into every session key).
  *
  * Per-turn *data credentials* (OBO token, e.g. X-Forwarded-Access-Token) are
  * handled by resolveDataToken — not read here.
  */
 function resolveUserId(headers, body, env = process.env) {
+    // Proof-of-proxy gate (IDENTITY_PROXY_SECRET_ENV): when configured, no identity — header OR
+    // body — is honoured without the matching secret header. A caller that fails this check is
+    // by definition not the trusted proxy, so the request runs anonymous rather than letting a
+    // network neighbour (or a dev body fallback) name a victim.
+    const proxySecret = env[exports.IDENTITY_PROXY_SECRET_ENV]?.trim();
+    if (proxySecret && !hasTrustedProxyProof(headers, proxySecret)) {
+        return undefined;
+    }
     const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim().toLowerCase();
     const names = pinned ? [pinned] : HEADER_ALIASES;
     for (const name of names) {
@@ -257,6 +493,10 @@ function resolveUserId(headers, body, env = process.env) {
         // access, gcloud run services proxy bypassing IAP) name an arbitrary victim.
         return undefined;
     }
+    // Unpinned body identity is an explicit opt-in, never a default (§10 hole 3).
+    if (env.AGENTHIPPO_ALLOW_BODY_IDENTITY?.trim() !== '1') {
+        return undefined;
+    }
     const fromBody = body?.user_id?.trim();
     return fromBody || undefined;
 }
@@ -315,20 +555,26 @@ function userNamespaceHash(userId) {
  * cross-user attachment structurally impossible without changing client behavior.
  *
  * Fail-closed rule: when the deployment pins an identity header (it declared a real
- * proxy-verified identity exists) and a request carries a session_id but no verified user,
- * reject — never let an unauthenticated caller name a session. Unpinned deployments
+ * proxy-verified identity exists), any turn without a verified user is rejected — with or
+ * without a session_id. Rejecting only named sessions would leave every identity-less
+ * caller sharing the durable `anon-unknown` conversation state. Unpinned deployments
  * (local dev, no identity boundary at all) keep today's raw-key behavior.
  */
-function resolveServeSessionKey(sessionId, userId, env = process.env) {
+function resolveServeSessionKey(sessionId, userId, scope = 'session', env = process.env) {
     const sid = sessionId?.trim();
     const uid = userId?.trim();
     if (uid) {
-        return { sessionKey: `u${userNamespaceHash(uid)}--${sid || 'default'}` };
+        const sessionKey = `u${userNamespaceHash(uid)}--${sid || 'default'}`;
+        return { sessionKey, sandboxKey: scope === 'user' ? `u${userNamespaceHash(uid)}` : sessionKey };
     }
-    if (sid && env[exports.IDENTITY_HEADER_ENV]?.trim()) {
-        return { sessionKey: '', rejected: exports.SESSION_WITHOUT_USER_REASON };
+    if (env[exports.IDENTITY_HEADER_ENV]?.trim()) {
+        return { sessionKey: '', sandboxKey: '', rejected: exports.SESSION_WITHOUT_USER_REASON };
     }
-    return { sessionKey: sid || 'anon-unknown' };
+    // No verified user, so there is no user to scope a sandbox TO. `user` scope deliberately does
+    // not apply here: merging unidentified callers would put two strangers in one sandbox on the
+    // strength of a fact nobody established. Local dev keeps one sandbox per session.
+    const sessionKey = sid || 'anon-unknown';
+    return { sessionKey, sandboxKey: sessionKey };
 }
 /** Build CORS headers. Serve is always behind a proxy; CORS is wide-open here. */
 function corsHeaders() {

package/out/cli/utils.js

@@ -77,6 +77,13 @@ function findClaudeCodePath() {
     if (depsPath) {
         return depsPath;
     }
+    // 2b. Our OWN dependency tree — the case where the runtime ships as a node app with the
+    // SDK already in node_modules. Without this, such a deployment fails with "Claude Code CLI
+    // not found" while the SDK sits right there (hit on the Hanoi VM, 2026-07-27).
+    const ownCli = (0, deps_1.resolveFromOwnDeps)('@anthropic-ai/claude-agent-sdk', 'cli.js');
+    if (ownCli) {
+        return ownCli;
+    }
     // 3. Check bundled location (next to binary) - legacy fallback
     const binaryDir = getBinaryDir();
     const bundledPath = path.join(binaryDir, 'claude-sdk', 'cli.js');
@@ -131,6 +138,10 @@ function findCodexPath() {
         return process.env.CODEX_PATH;
     }
     // 2. Check npm-installed location (.agenthippo-deps/node_modules)
+    const ownCodex = (0, deps_1.resolveFromOwnDeps)('@openai/codex', 'bin/codex.js');
+    if (ownCodex) {
+        return ownCodex;
+    }
     const depsPath = (0, deps_1.getCodexSdkBinaryPath)();
     if (depsPath) {
         return depsPath;
@@ -211,7 +222,7 @@ exports.COLORS = {
     red: '\x1b[31m',
     yellow: '\x1b[33m',
 };
-exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
+exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.5" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
 function getLiteLLMQuickstartHintLines() {
     return [
         'Try local LiteLLM quickstart:',

package/out/engines/base.js

@@ -1,6 +1,7 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -42,6 +43,7 @@ exports.generateRequestId = generateRequestId;
 exports.persistSessionIfNeeded = persistSessionIfNeeded;
 exports.touchSessionIfNeeded = touchSessionIfNeeded;
 exports.getPersistedSessionId = getPersistedSessionId;
+const identity_1 = require("../analytics/identity");
 const session_1 = require("../session");
 const path = __importStar(require("path"));
 /**
@@ -54,16 +56,26 @@ const path = __importStar(require("path"));
  * Langfuse passthrough: langfuse_session_id / langfuse_trace_user_id headers
  * are included so users who add Langfuse as a LiteLLM callback get session
  * grouping automatically.
+ *
+ * IDENTITY: the user id is a salted hash (see analytics/identity.ts). It used to be the raw
+ * value — usually an email — sent on two headers to a proxy that logs every request and forwards
+ * to a third-party observability backend. The hash is stable, so grouping and per-user analytics
+ * still work; it is just no longer a directory of who works here. Set
+ * AGENTHIPPO_EVIDENCE_RAW_IDS=1 to send the raw value again.
+ *
+ * The provider never sees either form: `additional_drop_params: ["user"]` in the LiteLLM config
+ * strips the end-user field before dispatch.
  */
 function buildLiteLLMMetadataHeaders(useLiteLLM, metadata) {
     if (!useLiteLLM) {
         return [];
     }
     const headers = [];
-    if (metadata.analyticsUserId?.trim()) {
-        headers.push(`x-litellm-metadata-user-id: ${metadata.analyticsUserId.trim()}`);
+    const userId = (0, identity_1.hashIdentity)(metadata.analyticsUserId);
+    if (userId) {
+        headers.push(`x-litellm-metadata-user-id: ${userId}`);
         // Langfuse passthrough: maps to Langfuse trace user_id when Langfuse callback is enabled
-        headers.push(`langfuse_trace_user_id: ${metadata.analyticsUserId.trim()}`);
+        headers.push(`langfuse_trace_user_id: ${userId}`);
     }
     if (metadata.sessionId?.trim()) {
         headers.push(`x-litellm-metadata-session-id: ${metadata.sessionId.trim()}`);
@@ -88,6 +100,23 @@ function buildLiteLLMMetadataHeaders(useLiteLLM, metadata) {
     if (metadata.requestId?.trim()) {
         headers.push(`x-litellm-metadata-request-id: ${metadata.requestId.trim()}`);
     }
+    // Provenance stamp (PLAN/compliance.md §3.1): lands in requester_metadata on every OTEL
+    // span, which is where the evidence index reads policy_version / pack_digest from.
+    if (metadata.policyVersion?.trim()) {
+        headers.push(`x-litellm-metadata-policy-version: ${metadata.policyVersion.trim()}`);
+    }
+    if (metadata.packDigest?.trim()) {
+        headers.push(`x-litellm-metadata-pack-digest: ${metadata.packDigest.trim()}`);
+    }
+    if (metadata.engineVersion?.trim()) {
+        headers.push(`x-litellm-metadata-engine-version: ${metadata.engineVersion.trim()}`);
+    }
+    if (metadata.tier !== undefined) {
+        headers.push(`x-litellm-metadata-tier: ${metadata.tier}`);
+    }
+    if (metadata.instanceId?.trim()) {
+        headers.push(`x-litellm-metadata-instance-id: ${metadata.instanceId.trim()}`);
+    }
     return headers;
 }
 /**

package/out/engines/claude.js

@@ -39,14 +39,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClaudeEngine = void 0;
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
+const branding_1 = require("../branding");
 const base_1 = require("./base");
 const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const mcp_1 = require("../mcp");
-const data_plane_1 = require("../cli/data-plane");
 const runtime_1 = require("../cli/runtime");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
+const credential_context_1 = require("../cli/credential-context");
 const shared_1 = require("../shared");
 // File tools we track for edit diffs via hooks (Set for O(1) lookup)
 // Includes Claude SDK tools, Computer Use tools, and common variations
@@ -261,6 +262,11 @@ class ClaudeEngine {
             source: 'agenthippo',
             engine: 'claude',
             requestId: options.requestId,
+            policyVersion: options.policyVersion,
+            packDigest: options.packDigest,
+            instanceId: options.instanceId,
+            engineVersion: options.engineVersion,
+            tier: options.tier,
         });
         // Build environment for Claude SDK.
         // Setup-token auth must use Claude's OAuth token env var instead of ANTHROPIC_API_KEY.
@@ -270,11 +276,13 @@ class ClaudeEngine {
             'DEBUG_CLAUDE_AGENT_SDK': '1',
             'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1',
         };
-        // Egress broker active ⇒ the gateway token stays broker-side; scrub it from the child
-        // env so it never reaches the model (secure-obo-design §7.6 / §7.4 gap 1).
-        if (claudeEnv[data_plane_1.EGRESS_URL_ENV]) {
-            delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
-        }
+        // The gateway token stays broker-side; scrub it from the child env so it never reaches
+        // the model (secure-obo-design §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2):
+        // gating this on the egress broker let a deployment without --gateway-bridge re-inherit
+        // the token, including via buildCliEnvPatch's bake from the host's ~/.openclaw config.
+        delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        // Data-plane sidecar control token: never the engine's to hold (secure-obo-design §7.6).
+        delete claudeEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
         const isSetupTokenAuth = (0, shared_1.isAnthropicSetupToken)(apiKey);
         if (isSetupTokenAuth) {
             const normalizedSetupToken = (0, shared_1.normalizeAnthropicSetupToken)(apiKey);
@@ -303,8 +311,13 @@ class ClaudeEngine {
         // Note: cwd is ALWAYS workspaceRoot - active agent content is synced to workspace's .claude/.codex
         const agentId = options.agentPackId ?? 'default';
         const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Claude config directory (isolated per agent for session/state isolation)
-        const claudeConfigDir = runtimePaths.claudeConfigDir;
+        // Claude config directory (isolated per agent for session/state isolation). In
+        // multi-tenant serve, additionally key it by the verified request user — the same
+        // §8 Phase 0 scoping codex.ts applies to CODEX_HOME. A shared per-agent dir lets
+        // concurrent turns of different users race each other's per-turn credential state
+        // (the agentpack/paths.ts race); per-user scoping makes any remaining race
+        // same-user. No credential frame (IDE, single-tenant CLI) ⇒ unchanged path.
+        const claudeConfigDir = (0, agentpack_1.userScopedEngineHomeFromKey)(runtimePaths.claudeConfigDir, (0, credential_context_1.resolveEngineHomeUserKey)(options.engineHomeUserKey));
         claudeEnv['CLAUDE_CONFIG_DIR'] = claudeConfigDir;
         await fs_1.promises.mkdir(claudeConfigDir, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -549,9 +562,10 @@ class ClaudeEngine {
                 logger.debug(`[AgentIDE] SessionStart hook called! event=${input.hook_event_name}`);
                 return CONTINUE;
             };
-            // Load MCP servers for the active agent and pass directly to SDK. claudeEnv is the
-            // per-turn child env — URL servers resolve their bearerTokenEnv (turn nonce) from it,
-            // in memory, so no per-turn value ever lands in a shared config file.
+            // Load MCP servers for the active agent and pass directly to SDK. URL servers carry a
+            // `${NAME}` bearer reference the CLI expands from claudeEnv at connect time, so the
+            // turn nonce rides neither a shared config file nor the SDK's --mcp-config argv —
+            // claudeEnv is passed for the rare non-expandable-name fallback only.
             const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId, claudeEnv);
             // Determine cwd and settingSources
             // cwd is ALWAYS workspaceRoot - active agent content has been synced to workspace's .claude/
@@ -1068,7 +1082,7 @@ class ClaudeEngine {
                 logger.info(`[AgentIDE] Claude thinking summary: startBlocks=${thinkingStartBlockCount}, redactedBlocks=${redactedThinkingBlockCount}, deltas=${thinkingDeltaCount}, chars=${thinkingCharCount}`);
                 logger.info(`[AgentIDE] Claude tool summary: toolBlocks=${toolUseBlockCount}, toolEmits=${toolUseEmitCount}, toolProgressMsgs=${toolProgressCount}, inputJsonDeltas=${inputJsonDeltaCount}`);
                 if (thinkingStartBlockCount === 0 && thinkingDeltaCount === 0 && redactedThinkingBlockCount === 0) {
-                    logger.debug('[AgentIDE] Claude emitted no thinking blocks/deltas. Ensure model supports extended thinking and set agentide.claude.maxThinkingTokens >= 1024.');
+                    logger.debug(`[AgentIDE] Claude emitted no thinking blocks/deltas. Ensure model supports extended thinking and set ${(0, branding_1.toSettingsDisplayKey)('agentide.claude.maxThinkingTokens')} >= 1024.`);
                 }
                 if (toolUseBlockCount === 0 && toolProgressCount === 0) {
                     logger.debug('[AgentIDE] Claude emitted no tool usage events. If tools were used, ensure includePartialMessages=true and parse tool_use blocks.');
@@ -1202,8 +1216,12 @@ class ClaudeEngine {
      * - Pack agents: uses pack's mcp/ directory
      *
      * The SDK accepts mcpServers directly in query options — including HTTP Streamable
-     * servers (`{type:'http', url, headers}`). `turnEnv` is the per-turn child env; a URL
-     * server's `bearerTokenEnv` (e.g. AGENTHIPPO_TURN_NONCE) resolves against it in memory.
+     * servers (`{type:'http', url, headers}`). A URL server's `bearerTokenEnv` (e.g.
+     * AGENTHIPPO_TURN_NONCE) becomes a `${NAME}` reference the CLI expands from its own env,
+     * NOT a resolved header: the SDK serializes mcpServers into `--mcp-config` argv, and a
+     * resolved bearer there is world-readable via /proc/<pid>/cmdline (see
+     * referenceHttpMcpHeaders). `turnEnv` is the per-turn child env, used only for the
+     * fallback when a name is outside the CLI's expansion grammar.
      */
     async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default', turnEnv) {
         const basePromptsDir = this.getBundledBasePromptsDir();
@@ -1214,7 +1232,7 @@ class ClaudeEngine {
         const mcpServers = {};
         for (const s of servers) {
             if (s.url) {
-                const headers = (0, mcp_1.resolveHttpMcpHeaders)(s, turnEnv ?? process.env);
+                const headers = (0, mcp_1.referenceHttpMcpHeaders)(s, turnEnv ?? process.env);
                 mcpServers[s.name] = {
                     type: 'http',
                     url: s.url,